This is proved entirely by Alt-Ergo
prover, and also in part by other SMT solvers. Unlike most other
examples of this gallery, we do not need
the Gappa prover, since
there is not floating-point rounding involved in this program.